Capture Loss using pcap file

Zeek
1

Dear all,

when I run Zeek/Bro (Version 2.6.3) against a rather large pcap file of about 8GB (one from the CICIDS2017 dataset) I get values in between 17 and 65% in capture_loss.log. What could be the reason for that? I am pretty new to the topic and couldn’t find anything about that via search. Is it a problem with Zeek like to much data or was the loss already in the pcap and has nothing to do with Zeek?

Thank you.

2

Hi Eva,

... Is it a
problem with Zeek like to much data or was the loss already in the pcap and
has nothing to do with Zeek?

The loss was already in the pcap. When running on pcaps, Zeek does not
drop any packets present in the pcap.

    Vern